{"id":"CVE-2026-42087","aliases":["EUVD-2026-27063","GHSA-v529-vhwc-wfc5","PYSEC-2026-2244"],"status":"published","title":"OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00323,"percentile":0.25608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-04-23T14:12:02Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"RubyGems","package":"openc3","fixed_in":["7.0.0-rc3"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"openc3","fixed_in":["7.0.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"openc3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"7.0.0-rc3"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"openc3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"7.0.0-rc3"}]}],"versions":["6.10.0","6.10.1","6.10.2","6.10.3","6.10.4","6.10.5","6.10.6","6.7.0","6.8.0","6.8.1","6.9.0","6.9.1","6.9.2"]},{"source":"osv","ecosystem":"PyPI","package":"openc3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"7.0.0"}]}],"versions":["6.10.0","6.10.1","6.10.2","6.10.3","6.10.4","6.10.5","6.10.6","6.7.0","6.8.0","6.8.1","6.9.0","6.9.1","6.9.2","7.0.0rc2","7.0.0rc3"]}],"products":[{"vendor":"openc3","product":"cosmos"}],"references":[{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3","tags":["x_refsource_MISC","Release Notes","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42087","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42087.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v529-vhwc-wfc5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42087.json","tags":["advisory"]},{"url":"https://github.com/OpenC3/cosmos","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42087","title":"OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","status":"published","published":"2026-05-04T17:18:02.965Z","modified":"2026-05-05T12:46:14.311Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-27063","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","status":"published","published":"2026-05-04T17:18:02Z","modified":"2026-05-05T12:46:14Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:05:17.068199Z"}],"ghsa":[{"id":"GHSA-v529-vhwc-wfc5","title":"OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database","description":"**Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nAttack type: Authenticated remote\nImpact: Telemetry data disclosure and deletion\nAffected components: openc3-tsdb (QuestDB)**\n\nA SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb` file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. \n \n\u003cimg width=\"940\" height=\"719\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2c2dd294-6192-49d3-b670-fd7b82c05be0\" /\u003e\n\nFigure 1: Source code vulnerable to SQL injection\nAdditionally, the `get_tlm_values` RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.\n \n\u003cimg width=\"940\" height=\"410\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40be7e8d-51f9-442d-bbd7-77c8488a2f78\" /\u003e\n\nFigure 2: Source code showing the required permissions for the `get_tlm_values` endpoint\nSending a normal request to the endpoint brings back a single array of values for the parameter:\n \n\u003cimg width=\"944\" height=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/23678f17-6bdf-41c1-81bc-ace5a8daa7e5\" /\u003e\n\nFigure 3: A normal request to the `get_tlm_values` endpoint\nHowever, sending a specially crafted request within the start_time variable brings back all the data in the database:\n \n\u003cimg width=\"944\" height=\"432\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bd5ecc87-ba9c-43f0-b196-91062b9c395a\" /\u003e\n\nFigure 4: The request and response after sending the SQL injection payload\nThis payload can be modified to executes SQL commands in the TSDB.\n \n\u003cimg width=\"944\" height=\"425\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70c3c88e-9ed6-4542-bfb4-e77abb002c15\" /\u003e\n\nFigure 5: SQL injection used to execute arbitrary SQL command\nThe user can then delete all the historical data in the database:\n \n\u003cimg width=\"944\" height=\"496\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f2dc1fa6-5fe0-4232-867a-a65776f108ee\" /\u003e\n\nFigure 6: Example payload dropping the tables\n###\tSteps to Reproduce\n1.\tCapture a JSON-RPC request to the `get_tlm_values` endpoint.\n2.\tAdd the `start_time` key to the request body and place the following in the value:\n```sql\n‘ OR 1=1 --\n```\n3.\tRetrieve all database data.\n###\tRecommendations\n•\tSanitize all user-supplied input before executing it\n•\tUse prepared statements with parameterized queries when executing SQL statements","status":"published","published":"2026-04-23T14:12:02Z","modified":"2026-05-29T21:46:52Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"nvd":[{"id":"CVE-2026-42087","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","status":"published","published":"2026-05-04T18:16:30.83Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"CVE-2026-42087","title":"OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","status":"published","published":"2026-05-04T17:18:02.965Z","modified":"2026-10-28T02:30:26.671077703Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-v529-vhwc-wfc5","title":"OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database","description":"**Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nAttack type: Authenticated remote\nImpact: Telemetry data disclosure and deletion\nAffected components: openc3-tsdb (QuestDB)**\n\nA SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb` file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. \n \n\u003cimg width=\"940\" height=\"719\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2c2dd294-6192-49d3-b670-fd7b82c05be0\" /\u003e\n\nFigure 1: Source code vulnerable to SQL injection\nAdditionally, the `get_tlm_values` RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.\n \n\u003cimg width=\"940\" height=\"410\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40be7e8d-51f9-442d-bbd7-77c8488a2f78\" /\u003e\n\nFigure 2: Source code showing the required permissions for the `get_tlm_values` endpoint\nSending a normal request to the endpoint brings back a single array of values for the parameter:\n \n\u003cimg width=\"944\" height=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/23678f17-6bdf-41c1-81bc-ace5a8daa7e5\" /\u003e\n\nFigure 3: A normal request to the `get_tlm_values` endpoint\nHowever, sending a specially crafted request within the start_time variable brings back all the data in the database:\n \n\u003cimg width=\"944\" height=\"432\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bd5ecc87-ba9c-43f0-b196-91062b9c395a\" /\u003e\n\nFigure 4: The request and response after sending the SQL injection payload\nThis payload can be modified to executes SQL commands in the TSDB.\n \n\u003cimg width=\"944\" height=\"425\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70c3c88e-9ed6-4542-bfb4-e77abb002c15\" /\u003e\n\nFigure 5: SQL injection used to execute arbitrary SQL command\nThe user can then delete all the historical data in the database:\n \n\u003cimg width=\"944\" height=\"496\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f2dc1fa6-5fe0-4232-867a-a65776f108ee\" /\u003e\n\nFigure 6: Example payload dropping the tables\n###\tSteps to Reproduce\n1.\tCapture a JSON-RPC request to the `get_tlm_values` endpoint.\n2.\tAdd the `start_time` key to the request body and place the following in the value:\n```sql\n‘ OR 1=1 --\n```\n3.\tRetrieve all database data.\n###\tRecommendations\n•\tSanitize all user-supplied input before executing it\n•\tUse prepared statements with parameterized queries when executing SQL statements","status":"published","published":"2026-04-23T14:12:02Z","modified":"2026-07-13T07:26:28.641096018Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"PYSEC-2026-2244","description":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.","status":"published","published":"2026-05-04T18:16:30.83Z","modified":"2026-07-13T07:15:38.980182568Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}